we have ingested the logs from microsoft azure using microsoft cloud services app on HF and we added some custom field in data input(inputs.conf) _meta=account_name::mscdes01 as that field is not present in raw logs. also added fields.conf on both indexer and search head and able to see the account_name field in the logs and looks good.
INDEXED = true
Here i have couple of questions.
1. will it create any performance issue if we using _meta option on HF.
2. can i create fields.conf file on HF instead creating on indexer & SH.
will it index the field if i create on HF.
3. why we are creating fields.conf on IDX and SH to extract that field.
Thanks for sharing the information, as you said we can add it fields.conf on HF instead of adding IDX and SH.
You CAN add the fields.conf on the HF, but it is only required for instances that are starting searches. So, unless your HF is used as a SH, no need for fields.conf there.
It is required on every search head!